{"action":"Upgrade org.apache.santuario:xmlsec to 1.4.3 or later.","affected":[{"fixed":"1.4.3","introduced":"1.4.0"}],"component":"org.apache.santuario:xmlsec","cve_ids":["CVE-2009-0217"],"ecosystem":"Maven","epss":0.06363,"exploited":false,"fixed_versions":["1.4.3"],"ghsa_id":"GHSA-8hfm-837h-hjg5","id":"tcs_01M5N8MWFHF9YBCJQ3GKH8HM2Z","modified_at":"2024-12-07T05:40:57.163585Z","published_at":"2022-05-02T03:13:38Z","references":["https://osv.dev/vulnerability/GHSA-8hfm-837h-hjg5","https://nvd.nist.gov/vuln/detail/CVE-2009-0217","https://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html","https://www.w3.org/2008/06/xmldsigcore-errata.html#e03","https://www.us-cert.gov/cas/techalerts/TA09-294A.html","https://www.ubuntu.com/usn/USN-903-1","https://www.redhat.com/support/errata/RHSA-2009-1694.html","https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html","https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html","https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html","https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html","https://www.mandriva.com/security/advisories?name=MDVSA-2009:209","https://www.kb.cert.org/vuls/id/WDON-7TY529","https://www.kb.cert.org/vuls/id/MAPG-7TSKXQ","https://www.kb.cert.org/vuls/id/466161","https://www.gentoo.org/security/en/glsa/glsa-201408-19.xml","https://www.debian.org/security/2010/dsa-1995","https://svn.apache.org/viewvc?revision=794013&view=revision","https://rhn.redhat.com/errata/RHSA-2009-1428.html","https://marc.info/?l=bugtraq&m=125787273209737&w=2","https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html","https://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html","https://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html","https://issues.apache.org/bugzilla/show_bug.cgi?id=47527","https://issues.apache.org/bugzilla/show_bug.cgi?id=47526","https://gitlab.gnome.org/Archive/xmlsec/-/commit/34b349675af9f72eb822837a8772cc1ead7115c7","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041","https://bugzilla.redhat.com/show_bug.cgi?id=511915","http://www.us-cert.gov/cas/techalerts/TA10-159B.html"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-8hfm-837h-hjg5","url":"https://osv.dev/vulnerability/GHSA-8hfm-837h-hjg5"}],"summary":"Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation"}